Ship fast, stay secure: from code to runtime | OD841

James Brotsos presents an end-to-end view of how security can be embedded into developer workflows without forcing major process changes, using GitHub Advanced Security and Microsoft Defender for Cloud.

Overview

The session focuses on shifting security left (into code and pull requests) while also connecting findings to runtime and cloud risk.

What problem the session addresses

• Developers increasingly “own” the pipeline and delivery process, which also makes security part of the developer responsibility.
• The goal is to catch issues where developers already work (CLI, repo, PR) and connect those issues to cloud/runtime risk.

Security embedded into developer workflows

• Security feedback is positioned to show up in:
  • The CLI
  • The GitHub repository
  • Pull requests
  • The cloud environment
• The session highlights an approach intended to avoid workflow disruption while still improving coverage.

Defender for Cloud + GitHub Advanced Security integration

• The talk centers on integrating:
  • GitHub Advanced Security (security signals in the repo/PR)
  • Microsoft Defender for Cloud (cloud security posture and risk context)

Demo: MDASH scanning pipeline

• The demo introduces an MDASH scanner setup.
• MDASH is described as a multi-agent AI scanning pipeline.
• The demo flow includes:
  • Running an MDASH scan
  • Discovering vulnerabilities that are described as “non-pattern” (not just simple signature matches)

AI-assisted remediation with Copilot

• The session shows AI-assisted fixing of vulnerabilities through Copilot.
• The developer review loop is shown in:
  • VS Code
  • Pull request security feedback

Security manager view and dashboards

• The session switches to a security manager perspective, including an Application Security Initiative Dashboard.

Connecting code vulnerabilities to cloud risk

• The talk includes attack path analysis to map code-level vulnerabilities to cloud/runtime risk.

GitHub workflow integration

• The session includes GitHub integration for:
  • Issue creation
  • Automated fix suggestions

AI model security

• The session calls out AI/ML supply-chain risks, including detecting:
  • Malicious pickle artifacts
  • Other model-related risks

End-to-end security lifecycle

• The session frames an end-to-end lifecycle that spans:
  • Code
  • CI/CD pipelines
  • Cloud/runtime
  • AI-related security considerations

Resources

• https://aka.ms/build26-next-steps
• Microsoft Build sessions: https://build.microsoft.com